alauda · chideat · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026
diff --git a/agent/ARCHITECTURE_FACTS.md b/agent/ARCHITECTURE_FACTS.md
@@ -19,9 +19,14 @@ that Operator baseline's 7.2, 8.1, and 9.1 image tags.
 
 - The product name is Alauda Cache Service E2, renamed from Alauda Build of
   Valkey: `.artifact/metadata.yaml` `displayName` and the OLM
-  ClusterServiceVersion base, commits `ebb4cbaf` through `0135484d`. The same
-  commits use the Valkey mark as an adjective and carry the upstream notice
-  "Valkey and the Valkey logo are trademarks of LF Projects, LLC."
+  ClusterServiceVersion base, commits `ebb4cbaf` through `0135484d`. Those
+  commits carried the upstream notice "Valkey and the Valkey logo are
+  trademarks of LF Projects, LLC." Commit `8702ca3`, merged to `release-2.0` as
+  `8f7e2cc` on 2026-09-05, replaced that notice in all four listing description
+  fields with the notice the ACP component compliance rules require verbatim, and
+  writes `Valkey®` at the first usage of the mark in every listing field. The
+  current wording is in `TERMINOLOGY.md`. The `valkey-operator` `master` branch
+  still carries the superseded notice until that change is cherry-picked.
 - The next major product release is `2.0.0`: `version:1`.
 - The Operator image map selects Valkey server lines `7.2`, `8.1`, and `9.1`:
   `values.yaml:17-34`. These are the only supported versions in product docs.
@@ -66,6 +71,17 @@ that Operator baseline's 7.2, 8.1, and 9.1 image tags.
   container baseline builds only the three supported lines; earlier baselines
   also carried 8.0 and 9.0 build directories. Product docs label the broader
   schema surface as unsupported.
+- The replication credential directive is not spelled the same on every supported
+  line. The credential-encryption patch registers it as `masterauth` with no
+  alias on 7.2 (`valkey/7.2/alpine/80_alauda_crypto.patch:146`) and as
+  `primaryauth` with `masterauth` as its alias on 8.1 and 9.1
+  (`valkey/8.1/alpine/80_alauda_crypto.patch:147`,
+  `valkey/9.1/alpine/80_alauda_crypto.patch:146`);
+  `internal/builder/config.go` forbids both spellings and records the rename in a
+  comment. `requirepass` is registered with no alias on all three lines. Any
+  passage that tells a reader to inspect the replication credential must name the
+  directive per line: `CONFIG GET primaryauth` returns an empty result on 7.2,
+  which reads as "not set" while the credential is in fact held by `masterauth`.
 - The Helm Chart CRD copy under `charts/valkey-operator/crds` is stale: it omits
   9.0 and 9.1, while the API type and canonical generated CRD include them. A
   2.0.0 release package must install the canonical schema so supported line 9.1

diff --git a/agent/SOURCE_POLICY.md b/agent/SOURCE_POLICY.md
@@ -26,9 +26,13 @@ For the initial 2.0.0 documentation, the inspected operator baseline is
 `origin/master` commit `20b3b6758fe6f5431e0e183e841d606b935c0853` from
 2026-08-11, together with the product-naming commits up to
 `0135484d90d7bff19bd56fe5d08ed4657fc26df7`, which rename the display title to
-Alauda Cache Service E2, align trademark usage with upstream, and change no
-code. The server-image baseline pinned by the Operator image tags is
-`7cb5874adf2c867dc2fc423435e33edc82226caa`.
+Alauda Cache Service E2 and change no code. The server-image baseline pinned by
+the Operator image tags is `7cb5874adf2c867dc2fc423435e33edc82226caa`.
+
+Trademark wording does not come from the upstream project. `TERMINOLOGY.md`
+carries the notice and the symbol rule that the ACP component compliance rules
+prescribe, and it is the source for every mark, notice, and symbol in these
+documents.
 
 The local `valkey` repository is container-source packaging rather than the
 upstream server source tree. Do not use it as evidence for command or protocol

diff --git a/agent/TECHNICAL_WRITING_POLICY.md b/agent/TECHNICAL_WRITING_POLICY.md
@@ -29,6 +29,12 @@ command. Preserve API field names exactly in code and use plain English in prose
   low-level API reference is specifically required.
 - Keep example resource requests and limits equal because the validating webhook
   warns when they differ.
+- Expand a product-domain abbreviation at first use on each page: ACL, PVC, CRD,
+  and CA. Do not expand a standard protocol, standards-body, or computing
+  abbreviation that is written as a proper name in its own specifications:
+  RFC (as in `RFC 3339`), IP, IPv4, IPv6, TCP, TLS, DNS, HTTP, URL, JSON, YAML,
+  CPU, SSH, CLI, and API. "Request for Comments 3339" and "Internet Protocol
+  version 4" are not the canonical names and read as unfamiliarity with them.
 - Never embed real passwords or tokens. Refer to a Kubernetes Secret in the same
   namespace and use interactive authentication with `valkey-cli`.
 

diff --git a/agent/TERMINOLOGY.md b/agent/TERMINOLOGY.md
@@ -30,6 +30,18 @@ i18n:
 | large key | `valkey-cli --bigkeys` | Key whose size or collection cardinality creates workload-specific operational risk. Do not imply one universal size threshold. |
 | Web Console | — | Unsupported for this product; do not provide UI instructions. |
 
-Valkey and the Valkey logo are trademarks of LF Projects, LLC. Use the Valkey
-mark as an adjective with a generic noun in product-listing text, for example
-“Valkey server 7.2” and “built on Valkey™ technology”.
+## Trademark notice and symbol
+
+Valkey® is a registered trademark of LF Projects, LLC.
+
+Alauda is an independent vendor. This product is not affiliated with, endorsed by, or sponsored by LF Projects, LLC. All trademarks are the property of their respective owners and are used here for identification purposes only.
+
+Those two paragraphs are the notice the ACP component compliance rules require
+verbatim. Reproduce them without rewording: in the product-listing description
+fields, and once in user documentation, where they are the `## Trademarks`
+section of `docs/en/intro.mdx`. Write `Valkey®`, never `Valkey™`: the mark is
+registered, and the symbol belongs at the first usage of the mark in each display
+field. Use the mark as an adjective with a generic noun, for example “Valkey®
+server 7.2” and “built on Valkey® technology”. Code spans naming the API kind
+`Valkey`, the CRD group, image paths, and field names are technical identifiers:
+they carry no symbol and are never renamed.
diff --git a/docs/en/apis/kubernetes_apis/valkey/valkey.mdx b/docs/en/apis/kubernetes_apis/valkey/valkey.mdx
@@ -27,7 +27,7 @@ Cluster shard or the total data-member count for Failover/Replica.
 | `spec.customConfigs` | Valkey configuration directives | Operator-owned directives are filtered; some changes require restart. |
 | `spec.modules` | Startup module path and arguments | The Operator only renders `loadmodule`. Standard inspected images contain no module files, and this API has no image override; use only a product-delivered and validated module. |
 | `spec.storage` | Persistent volume claim (PVC) capacity, class, and annotations | The schema accepts an access mode, but generated PVCs always request `ReadWriteOnce`. In the inspected baseline, `retainAfterDeleted` has no effect and generated PVCs remain after deletion; review them explicitly. |
-| `spec.access` | Service type, annotations, Internet Protocol (IP) family, fixed ports, and TLS issuer | Leave fixed `ports` unset unless the delivered build resolves the documented format conflict. |
+| `spec.access` | Service type, annotations, IP family, fixed ports, and TLS issuer | Leave fixed `ports` unset unless the delivered build resolves the documented format conflict. |
 | `spec.podAnnotations` | Data-workload annotations and lifecycle triggers | Pause and restart use reserved annotation keys documented in the guides. |
 | `spec.affinityPolicy` | Built-in placement policy | Cluster `AntiAffinity` is shard-local in the implementation, and the `CustomAffinity` literal does not activate the Cluster builder's custom-affinity branch. |
 | `spec.nodeSelector` | Node label selection | Standard Kubernetes selector semantics. |

diff --git a/docs/en/functions/10-create-instance.mdx b/docs/en/functions/10-create-instance.mdx
@@ -30,7 +30,7 @@ major release, 2.0.0, supports only `7.2`, `8.1`, and `9.1` in `spec.version`.
 | `spec.replicas.replicasOfShard` | Total data-member count: 1–5. Use at least 2 for primary-replica redundancy. |
 | `spec.resources` | Set CPU and memory requests and limits; equal values avoid a webhook warning. |
 | `spec.storage` | Omit for ephemeral storage, or set capacity and StorageClass. Generated persistent volume claims always request the `ReadWriteOnce` access mode. |
-| `spec.access` | Select ClusterIP, NodePort, or LoadBalancer and the Internet Protocol (IP) family; optionally enable TLS. |
+| `spec.access` | Select ClusterIP, NodePort, or LoadBalancer and the IP family; optionally enable TLS. |
 | `spec.affinityPolicy` | Choose a policy that the available node count can satisfy. |
 | `spec.customConfigs` | Set only directives that the Operator does not own or forbid. |
 | `spec.exporter` | Enabled by default; size the sidecar or explicitly disable it. |
@@ -167,8 +167,8 @@ spec:
 EOF
 ```
 
-Set `replicasOfShard: 1` only when you intentionally want a single data node and
-accept the lack of primary-replica redundancy.
+Set `replicasOfShard: 1` only when you intentionally want a single data member
+and accept the lack of primary-replica redundancy.
 
 ## Verify the instance
 

diff --git a/docs/en/functions/30-parameter.mdx b/docs/en/functions/30-parameter.mdx
@@ -143,10 +143,12 @@ If ACL authentication is enabled, use `--user <username> --askpass`. With TLS,
 run the CLI from a location where the issued certificates are available and add
 the TLS options described in [Access and TLS](./40-accessmethod.mdx).
 
-On the delivered server images, credential directives such as `requirepass` and
-`primaryauth` are redacted in `CONFIG GET` output: a set credential is reported
-as a fixed placeholder rather than its value. Do not use `CONFIG GET` to read
-back a password; passwords are managed through Kubernetes Secrets and the
+On the delivered server images, credential directives are redacted in
+`CONFIG GET` output: a set credential is reported as a fixed placeholder rather
+than its value. The directives are `requirepass` and the replication credential,
+which is `masterauth` on 7.2 and `primaryauth` on 8.1 and 9.1, where
+`masterauth` is kept as an alias. Do not use `CONFIG GET` to read back a
+password; passwords are managed through Kubernetes Secrets and the
 `User` resource.
 
 Removing a map entry updates generated configuration, but the inspected hot

diff --git a/docs/en/functions/40-accessmethod.mdx b/docs/en/functions/40-accessmethod.mdx
@@ -64,10 +64,10 @@ Discover the actual Services instead of constructing names in automation:
 kubectl -n default get service -l buf.red/name=valkey-failover -o wide
 ```
 
-## Internet Protocol family
+## IP family
 
-Set `spec.access.ipFamilyPrefer` to Internet Protocol (IP) version 4 (`IPv4`) or
-version 6 (`IPv6`). The generated Services use a single-stack IP family policy.
+Set `spec.access.ipFamilyPrefer` to `IPv4` or `IPv6`. The generated Services use
+a single-stack IP family policy.
 Ensure the cluster, nodes, load balancer, DNS, and clients support the selected
 family before changing an existing instance.
 

diff --git a/docs/en/functions/90-restart.mdx b/docs/en/functions/90-restart.mdx
@@ -8,7 +8,7 @@ title: Rolling restart
 
 # Rolling restart
 
-Set a new Request for Comments (RFC) 3339 timestamp in
+Set a new RFC 3339 timestamp in
 `spec.podAnnotations["kubectl.kubernetes.io/restartedAt"]` to trigger workload
 template updates and rolling Pod replacement. The value must parse as a timestamp
 and be later than the previously recorded value; reusing or decreasing it does

diff --git a/docs/en/functions/index.mdx b/docs/en/functions/index.mdx
@@ -3,7 +3,7 @@ weight: 50
 i18n:
   title:
     zh: 功能指南
-title: Guides
+title: Feature guides
 ---
 
 <Overview />
diff --git a/docs/en/how_to/index.mdx b/docs/en/how_to/index.mdx
@@ -3,7 +3,7 @@ weight: 60
 i18n:
   title:
     zh: 实用指南
-title: HowTo
+title: How-to guides
 ---
 
 <Overview />
diff --git a/docs/en/intro.mdx b/docs/en/intro.mdx
@@ -3,6 +3,14 @@ weight: 10
 i18n:
   title:
     zh: 介绍
+  additionalPrompts: |
+    The two paragraphs under the "## Trademarks" heading are a required legal
+    notice. Reproduce them in English, verbatim and in the same order, exactly as
+    they appear in the source. Do not translate, reword, shorten, or drop them.
+    After the English paragraphs, append the approved Chinese rendering below as
+    a third paragraph, copied verbatim. Do not write your own translation, and do
+    not alter, reorder, or drop the English paragraphs above it:
+    Valkey® 是 LF Projects, LLC 的注册商标。Alauda 是独立供应商，本产品与 LF Projects, LLC 无关联，亦未获其背书或赞助。所有商标均为其各自所有者的财产，此处仅用于识别目的。
 title: Introduction
 ---
 
@@ -11,7 +19,8 @@ title: Introduction
 Alauda Cache Service E2 deploys and operates Valkey instances on Kubernetes
 through declarative custom resources. The Valkey Operator reconciles the desired
 state, creates the data-plane workloads and Services, and performs lifecycle
-operations such as scaling, configuration updates, upgrades, and node recovery.
+operations such as scaling, configuration updates, upgrades, and member
+recovery.
 
 All instance operations are CLI-based. This product does not provide a Web
 Console. Use `kubectl`, `valkey-cli`, and Kubernetes-native automation.
@@ -40,9 +49,9 @@ another line does not establish product support.
 | Replica | `replica` | Runs one primary-replica group without Sentinel. | Choose 1 member only for non-high-availability use; use at least 2 when replication is required. |
 
 `spec.replicas.replicasOfShard` is a legacy field name. In the implemented
-workload, it is the total member count per Cluster shard, or the total data-node
-count for Failover and Replica. For example, `replicasOfShard: 2` creates one
-primary and one replica after reconciliation.
+workload, it is the total member count per Cluster shard, or the total
+data-member count for Failover and Replica. For example, `replicasOfShard: 2`
+creates one primary and one replica after reconciliation.
 
 ## Implemented capabilities
 
@@ -87,6 +96,8 @@ specification](https://valkey.io/topics/cluster-spec/), [Valkey
 replication](https://valkey.io/topics/replication/), and [Valkey
 Sentinel](https://valkey.io/topics/sentinel/).
 
----
+## Trademarks
+
+Valkey® is a registered trademark of LF Projects, LLC.
 
-Valkey and the Valkey logo are trademarks of LF Projects, LLC.
+Alauda is an independent vendor. This product is not affiliated with, endorsed by, or sponsored by LF Projects, LLC. All trademarks are the property of their respective owners and are used here for identification purposes only.
diff --git a/docs/en/limitations.mdx b/docs/en/limitations.mdx
@@ -31,8 +31,9 @@ defect, not a reason to bypass admission.
 ## Backup, restore, and disaster recovery
 
 The Valkey Operator does not support backup, restore, or disaster recovery. It
-does not provide a backup resource, restore workflow, scheduled backup controller,
-cross-cluster replication, cross-cluster failover, or disaster-recovery API.
+does not provide a backup resource, restore workflow, scheduled backup
+controller, cross-Kubernetes-cluster replication, cross-Kubernetes-cluster
+failover, or a disaster-recovery API.
 High availability within one Kubernetes cluster is not backup or disaster
 recovery. No disaster-recovery procedure is included in this product documentation.
 
@@ -114,15 +115,17 @@ TLS-passphrase directives, are filtered case-insensitively on the Cluster,
 Failover, and Sentinel configuration paths; a case variant cannot bypass the
 Operator-owned list.
 Verify the generated ConfigMap and the effective server configuration. On the
-delivered server images, `CONFIG GET` reports a set `requirepass` or
-`primaryauth` value as a fixed redaction placeholder, not the credential.
+delivered server images, `CONFIG GET` reports a set `requirepass` value, or a
+set replication credential, as a fixed redaction placeholder rather than the
+credential. The replication directive is `masterauth` on 7.2 and `primaryauth`
+on 8.1 and 9.1, where `masterauth` is kept as an alias.
 
 ## Features not implemented by the Operator
 
 - integrated large-key inspection and report export;
 - parameter templates;
 - integrated log viewer;
-- automatic cross-cluster replication or failover;
+- automatic cross-Kubernetes-cluster replication or failover;
 - an Operator-managed backup repository or restore job.
 
 The absence of an integrated large-key report does not prevent a controlled

diff --git a/docs/en/release_notes.mdx b/docs/en/release_notes.mdx
@@ -76,8 +76,10 @@ The 2.0.0 baseline hardens how instance credentials are stored and exposed:
   into rendered configuration encrypted with a per-instance key. The Operator
   manages that key in a dedicated Secret; only the key, never a password
   Secret, is mounted into instance containers.
-- On the delivered server images, `CONFIG GET` reports a set `requirepass` or
-  `primaryauth` value as a fixed redaction placeholder.
+- On the delivered server images, `CONFIG GET` reports a set `requirepass`
+  value, or a set replication credential, as a fixed redaction placeholder. The
+  replication directive is `masterauth` on 7.2 and `primaryauth` on 8.1 and 9.1,
+  where `masterauth` is kept as an alias.
 - The exporter no longer receives the password through an environment
   variable; it resolves the referenced Secret through the Kubernetes API.
 - Sentinel keeps its rewritten configuration on a memory-backed volume rather
@@ -94,7 +96,8 @@ Version 2.0.0 is CLI-only and does not include a Web Console. Use `kubectl` and
 ### Excluded capabilities
 
 Disaster recovery is not supported. The Operator also does not implement
-integrated backup/restore, cross-cluster replication or failover, integrated
+integrated backup/restore, cross-Kubernetes-cluster replication or failover,
+integrated
 large-key inspection reports, or parameter templates. See
 [Current limitations](./limitations.mdx).
 

diff --git a/docs/en/trouble_shooting/10-instance-not-ready.mdx b/docs/en/trouble_shooting/10-instance-not-ready.mdx
@@ -133,7 +133,7 @@ Provide the following with Secret values removed:
 
 - `Valkey` and relevant child-resource YAML;
 - Events and Pod descriptions;
-- Operator, data-node, Sentinel, and exporter logs for a bounded time range;
+- Operator, Valkey server, Sentinel, and exporter logs for a bounded time range;
 - PVC, Service, EndpointSlice, and Certificate status;
 - `CLUSTER INFO` and `CLUSTER NODES`, or `INFO replication`;
 - the product version, Operator image, server images, exact failure time, and

diff --git a/docs/en/trouble_shooting/index.mdx b/docs/en/trouble_shooting/index.mdx
@@ -2,8 +2,8 @@
 weight: 70
 i18n:
   title:
-    zh: 常见问题
-title: Trouble Shooting
+    zh: 故障排查
+title: Troubleshooting
 ---
 
 <Overview />